summaryrefslogtreecommitdiff
path: root/postfix/postfix.sh
blob: fc9076c25932ace73cc0f0fa3cc0a83d778ca018 (plain) 
    

  1. #!/bin/sh
    2. 

  2. #
    3. 

  3. # /etc/local-COMMON/postfix/postfix.sh
    4. 

  4. # Copyright 2002-2007 Jonas Smedegaard <dr@jones.dk>
    5. 

  5. #
    6. 

  6. # $Id: postfix.sh,v 1.76 2008-05-25 19:00:16 jonas Exp $
    7. 

  7. #
    8. 

  8. # Auto-tweak plain installed postfix Debian package
    9. 

  9. #
    10. 

  10. # TODO:
    11. 

  11. #  * Implement stuff from here: http://www.wsrcc.com/spam/
    12. 

  12. #  * Implement stuff from here: http://www.muine.org/~hoang/postfix.html
    13. 

  13. #  * Implement stuff from here: http://jimsun.linxnet.com/misc/postfix-anti-UCE.txt
    14. 

  14. #  * Figure out a way to use chroot jail for TLS stuff.
    15. 

  15. #  * Use https://www.dnswl.org/
    16. 

  16. 

  17. set -e
    18. 

  18. 

  19. # Let's standardize sort
    20. 

  20. export LC_ALL=C
    21. 

  21. 

  22. warn()  {
    23. 

  23.     echo >&2 "Warning: $1"
    24. 

  24. }
    25. 

  25. 

  26. exit1() {
    27. 

  27.     echo >&2 "Error: $1"
    28. 

  28.     echo >&2 "Exiting..."
    29. 

  29.     exit 1
    30. 

  30. }
    31. 

  31. 

  32. realmsdir='/etc/local-REDPILL'
    33. 

  33. configdirs='/etc/local /etc/local-ORG /etc/local-REDPILL /etc/local-COMMON'
    34. 

  34. confdir='/etc/postfix'
    35. 

  35. if ! [ -d "$realmsdir" ]; then
    36. 

  36.     warn "Realms directory \"$realmsdir\" does not exist."
    37. 

  37. fi
    38. 

  38. #postgrey=
    39. 

  39. #if [ -x /usr/sbin/postgrey ]; then
    40. 

  40. #   # FIXME: Use this somehow, and only warn below
    41. 

  41. #   postgrey=1
    42. 

  42. #else
    43. 

  43. #   exit1 "ERROR: Greylisting support (Debian package postgrey) missing."
    44. 

  44. #fi
    45. 

  45. dovecot=
    46. 

  46. dovecot_lmtp=
    47. 

  47. dovecot_deliver=
    48. 

  48. if [ -x /usr/sbin/dovecot ]; then
    49. 

  49.     dovecot=1
    50. 

  50.     if [ -x /usr/lib/dovecot/lmtp ]; then
    51. 

  51.         dovecot_lmtp=1
    52. 

  52.     elif [ -x /usr/lib/dovecot/deliver ]; then
    53. 

  53.         warn "Dovecot LMTP missing - (Debian package dovecot-lmtp)."
    54. 

  54.         dovecot_deliver=1
    55. 

  55.     else
    56. 

  56.         warn "Dovecot deliver missing."
    57. 

  57.     fi
    58. 

  58. else
    59. 

  59.     warn "Dovecot missing - (Debian package dovecot-core or dovecot)."
    60. 

  60. fi
    61. 

  61. tls_cert=
    62. 

  62. if [ -f /etc/ssl/certs/postfix.pem ] && [ -f /etc/ssl/private/postfix.pem ]; then
    63. 

  63.     tls_cert=1
    64. 

  64. else
    65. 

  65.     warn "No TLS encryption - requires SSL certificate at /etc/ssl/certs/postfix.pem and private key at /etc/ssl/private/postfix.pem."
    66. 

  66. fi
    67. 

  67. # TODO: enable only on systems with user accounts
    68. 

  68. submission=1
    69. 

  69. # TODO: check that dovecot SASL is configured
    70. 

  70. sasl_inbound=
    71. 

  71. if [ -n "$tls_cert" ] && [ -n "$dovecot" ] && [ -n "$submission" ]; then
    72. 

  72.     sasl_inbound=1
    73. 

  73. else
    74. 

  74.     warn "No inbound SASL authentication - requires TLS encryption and Dovecot."
    75. 

  75. fi
    76. 

  76. amavis=
    77. 

  77. default_amavis_maxproc=2
    78. 

  78. if [ -x /usr/sbin/amavisd ] || [ -x /usr/sbin/amavisd-new ]; then
    79. 

  79.     amavis=1
    80. 

  80. else
    81. 

  81.     warn "AMaViS missing (Debian package amavisd-new)."
    82. 

  82. fi
    83. 

  83. dkimproxy=
    84. 

  84. #dkimproxy_maxproc_in=5
    85. 

  85. # FIXME: update actual outgoing maxproc from /etc/default/dkimproxy (and /etc/dkimproxy/dkimproxy_out.conf too?)
    86. 

  86. dkimproxy_maxproc_out=5
    87. 

  87. if [ -x /usr/sbin/dkimproxy.in ]; then
    88. 

  88.     if [ "1" = "$amavis" ]; then
    89. 

  89.         dkimproxy=1
    90. 

  90.     else
    91. 

  91.         warn "No DKIM/Domainkey - requires DKIMproxy and AMaViS."
    92. 

  92.     fi
    93. 

  93. else
    94. 

  94.     warn "DKIMproxy missing (Debian package dkimproxy)."
    95. 

  95. fi
    96. 

  96. 

  97. catfilefromownrealm() {
    98. 

  98.     set -e
    99. 

  99.     file="$1"
    100. 

  100.     [ -d "$realmsdir" ] || exit 0
    101. 

  101. 

  102.     thisrealm="$(cat /etc/local-ORG/realm || dnsdomainname | tr '[a-z]' '[A-Z]')"
    103. 

  103. 

  104.     cat "$realmsdir/$thisrealm/$file"
    105. 

  105. }
    106. 

  106. 

  107. catallfilesfromotherrealms() {
    108. 

  108.     set -e
    109. 

  109.     file="$1"
    110. 

  110.     [ -d "$realmsdir" ] || exit 0
    111. 

  111.     [ -f "$realmsdir/realms" ] || exit 0
    112. 

  112. 

  113.     realms="$(cat "$realmsdir/realms" | sed 's/#.*//')"
    114. 

  114.     thisrealm="$(cat /etc/local-ORG/realm || dnsdomainname | tr '[a-z]' '[A-Z]')"
    115. 

  115. 

  116.     for realm in $realms; do
    117. 

  117.         if [ "$thisrealm" != "$realm" ]; then
    118. 

  118.             cat "$realmsdir/$realm/$file"
    119. 

  119.         fi
    120. 

  120.     done
    121. 

  121. }
    122. 

  122. 

  123. catfirstfile() {
    124. 

  124.     set -e
    125. 

  125.     file="$1"
    126. 

  126.     context="${2:-postfix}"
    127. 

  127.     configdir=''
    128. 

  128.     for dir in $configdirs; do
    129. 

  129.         if [ -d "$dir/$context" ] && [ -f "$dir/$context/$file" ]; then
    130. 

  130.             configdir="$dir/$context"
    131. 

  131.             break
    132. 

  132.         fi
    133. 

  133.     done
    134. 

  134.     if [ -z "$configdir" ]; then
    135. 

  135.         exit1 "ERROR: file \"$file\" not found."
    136. 

  136.     fi
    137. 

  137.     cat "$configdir/$file"
    138. 

  138. }
    139. 

  139. 

  140. # TODO: support quoted string, and trailing comment.
    141. 

  141. getperlvarfromfile() {
    142. 

  142.     set -e
    143. 

  143.     export var="$1"
    144. 

  144.     export default="$2"
    145. 

  145.     file="$3"
    146. 

  146.     context="${4:-postfix}"
    147. 

  147.     catfirstfile "$file" "$context" \
    148. 

  148.         | perl -nE'/^\$$ENV{"var"}\h*=\h*(\d+)/ and $s=$1; END {print length($s) ? $s : $ENV{'default'}}'
    149. 

  149. }
    150. 

  150. 

  151. getlinesfromfile() {
    152. 

  152.     set -e
    153. 

  153.     param="$1"
    154. 

  154.     shift
    155. 

  155.     replacements=
    156. 

  156.     for subparam in $@; do
    157. 

  157.         case "$subparam" in
    158. 

  158.             *=)
    159. 

  159.             oldparam="`echo $subparam | awk -F= '{print $1}'`"
    160. 

  160.             replacements="$replacements;s/,*[^,]*$oldparam[^,]*,*/,/"
    161. 

  161.             continue
    162. 

  162.             ;;
    163. 

  163.             *=*=*)
    164. 

  164.             oldparam="`echo $subparam | awk -F= '{print $1}'`"
    165. 

  165.             newparam="`echo $subparam | awk -F= '{print $2}'`"
    166. 

  166.             newparamfile="`echo $subparam | awk -F= '{print $3}'`"
    167. 

  167.             ;;
    168. 

  168.             *)
    169. 

  169.             oldparam=$subparam
    170. 

  170.             newparam=$subparam
    171. 

  171.             newparamfile=$subparam
    172. 

  172.             ;;
    173. 

  173.         esac
    174. 

  174.         newparamvalues="`getlinesfromfile $newparamfile | sed -e 's/.*=[ ]*//' -e 's/,/ /g'`"
    175. 

  175.         newstring=
    176. 

  176.         for newparamvalue in $newparamvalues; do
    177. 

  177.             newstring="${newstring}$newparam $newparamvalue,"
    178. 

  178.         done
    179. 

  179.         replacements="$replacements;s/$oldparam/$newstring/"
    180. 

  180.     done
    181. 

  181.     echo -n "$param = "
    182. 

  182.     catfirstfile "$param" | sed 's/#.*//' | tr '\n' ',' | sed -e 's/^[,     ]*//;s/[,   ]\+/,/g' -e 's/\^/ /g' -e "s/,\$//$replacements"
    183. 

  183. }
    184. 

  184. 

  185. _postconf() {
    186. 

  186.     postconf -c "$tempdir" "$1" "$(echo "$2" | tr '\n' ' ')"
    187. 

  187. }
    188. 

  188. 

  189. postmapfiles=
    190. 

  190. 

  191. tempdir="$(mktemp -td postfix.XXXXXX)"
    192. 

  192. cp -a -t "$tempdir" "$confdir"/*
    193. 

  193. 

  194. # Inspired by D. J. Bernstein: http://cr.yp.to/smtp/greeting.html
    195. 

  195. _postconf -e 'smtpd_banner = $myhostname NO UCE ESMTP $mail_name (Debian/GNU)'
    196. 

  196. 

  197. # Some badly configured setup use hostname instead of FQDN
    198. 

  198. # Disable completely: Effective, but hurts executive type guys using windows servers... :-(
    199. 

  199. #if _postconf myhostname | grep -q '\.'; then
    200. 

  200. #   _postconf -e 'smtpd_helo_required = yes'
    201. 

  201. #fi
    202. 

  202. _postconf -e 'smtpd_helo_required = no'
    203. 

  203. _postconf -e "`getlinesfromfile permit_mx_backup_networks`"
    204. 

  204. _postconf -e "maps_rbl_domains ="
    205. 

  205. _postconf -e "`getlinesfromfile smtpd_client_restrictions reject_rhsbl_client`"
    206. 

  206. _postconf -e "`getlinesfromfile smtpd_helo_restrictions`"
    207. 

  207. _postconf -e "`getlinesfromfile smtpd_sender_restrictions reject_rhsbl_sender ${dkimproxy:-sender_access_regex=}`"
    208. 

  208. _postconf -e "`getlinesfromfile smtpd_recipient_restrictions reject_maps_rbl=reject_rbl_client=maps_rbl_domains`"
    209. 

  209. _postconf -e "`getlinesfromfile smtpd_data_restrictions`"
    210. 

  210. 

  211. # FIXME: clear only specific line (not whole file) when dkimproxy unused
    212. 

  212. if [ -f "$tempdir/sender_access_regex" ]; then
    213. 

  213.     if [ -n "$dkimproxy" ]; then
    214. 

  214.         grep -q -F '/^/  FILTER dkimsign:[127.0.0.1]:10026' "$tempdir/sender_access_regex" \
    215. 

  215.         || echo '/^/  FILTER dkimsign:[127.0.0.1]:10026' >> "$tempdir/sender_access_regex"
    216. 

  216.     else
    217. 

  217.         if grep -q -F '/^/  FILTER dkimsign:[127.0.0.1]:10026' "$tempdir/sender_access_regex"; then
    218. 

  218.             echo "echo '' > \"$confdir/sender_access_regex\"" >> "$tempdir/COMMANDS"
    219. 

  219.             rm "$tempdir/sender_access_regex"
    220. 

  220.         fi
    221. 

  221.     fi
    222. 

  222.     postmapfiles="$postmapfiles sender_access_regex"
    223. 

  223. fi
    224. 

  224. 

  225. # Support exceptions to default response
    226. 

  226. # (Day Old Bread (dob) lists need to reject only temporarily)
    227. 

  227. _postconf -e "rbl_reply_maps = hash:$confdir/rbl_reply_map"
    228. 

  228. cat /etc/local-COMMON/postfix/rbl_reply_map \
    229. 

  229.     | sed 's/#.*//' \
    230. 

  230.     > "$tempdir/rbl_reply_map"
    231. 

  231. postmapfiles="$postmapfiles rbl_reply_map"
    232. 

  232. 

  233. # Verify senders of common suspicious and known verifiable domains
    234. 

  234. # (exclude verification of postmaster@ to not verify verification probes)
    235. 

  235. # (add own domains before peers for (rare) cases of duplicates)
    236. 

  236. # FIXME: somehow do this step only if enabled in smtpd_sender_restrictions
    237. 

  237. # TODO: Properly implement exception exclusion like yahoo (which does not want to be checked any longer!)
    238. 

  238. cat /etc/local-COMMON/postfix/maildomains | grep -v yahoo | sort | sed 's/$/    reject_unverified_sender/' > "$tempdir/sender_access"
    239. 

  239. ( catfilefromownrealm maildomains | sort; catallfilesfromotherrealms maildomains | sort ) \
    240. 

  240.     | sed 's/\(.*\)$/postmaster@\1  permit\n\1  reject_unverified_sender/' >> "$tempdir/sender_access"
    241. 

  241. [ ! -f "$tempdir/sender_access.addon" ] || cat "$tempdir/sender_access.addon" >> "$tempdir/sender_access"
    242. 

  242. postmapfiles="$postmapfiles sender_access"
    243. 

  243. _postconf -e "unverified_sender_reject_code = 550"
    244. 

  244. 

  245. # Trust recipient verification too
    246. 

  246. _postconf -e "unverified_recipient_reject_code = 550"
    247. 

  247. 

  248. if [ -n "$dovecot_lmtp" ]; then
    249. 

  249.     _postconf -e mailbox_transport=lmtp:unix:private/dovecot-lmtp
    250. 

  250.     _postconf -X mailbox_command
    251. 

  251. elif [ -n "$dovecot_deliver" ]; then
    252. 

  252.     _postconf -X mailbox_transport
    253. 

  253.     _postconf -e mailbox_command=/usr/lib/dovecot/deliver
    254. 

  254. else
    255. 

  255.     _postconf -X mailbox_transport
    256. 

  256.     _postconf -X mailbox_command
    257. 

  257. fi
    258. 

  258. 

  259. # outbound opportunistic encryption
    260. 

  260. _postconf -e smtp_tls_security_level=may
    261. 

  261. _postconf -e smtp_tls_cert_file=/etc/ssl/certs/postfix.pem
    262. 

  262. _postconf -e smtp_tls_key_file=/etc/ssl/private/postfix.pem
    263. 

  263. _postconf -e smtp_tls_loglevel=1
    264. 

  264. 

  265. # Force TLS towards peers
    266. 

  266. catallfilesfromotherrealms mailhost | sort | sed 's/^/[/;s/$/]:submission   secure/' > "$tempdir/tls_policy"
    267. 

  267. [ ! -f "$tempdir/tls_policy.addon" ] || cat "$tempdir/tls_policy.addon" >> "$tempdir/tls_policy"
    268. 

  268. postmapfiles="$postmapfiles tls_policy"
    269. 

  269. _postconf -e smtp_tls_policy_maps="hash:$confdir/tls_policy"
    270. 

  270. 

  271. # inbound opportunistic encryption
    272. 

  272. if [ -n "$tls_cert" ]; then
    273. 

  273.     _postconf -e smtpd_tls_security_level=may
    274. 

  274.     _postconf -e 'smtpd_tls_cert_file = /etc/ssl/certs/postfix.pem'
    275. 

  275.     _postconf -e 'smtpd_tls_key_file = /etc/ssl/private/postfix.pem'
    276. 

  276.     _postconf -e 'smtpd_tls_loglevel = 1'
    277. 

  277.     _postconf -e 'smtpd_tls_auth_only = yes'
    278. 

  278.     _postconf -e 'smtpd_tls_received_header = yes'
    279. 

  279. else
    280. 

  280.     _postconf -e smtpd_tls_security_level=none
    281. 

  281.     _postconf -X smtpd_tls_cert_file
    282. 

  282.     _postconf -X smtpd_tls_key_file
    283. 

  283.     _postconf -X smtpd_tls_loglevel
    284. 

  284.     _postconf -X smtpd_tls_auth_only
    285. 

  285.     _postconf -X smtpd_tls_received_header
    286. 

  286. fi
    287. 

  287. # Avoid smtpd_tls_CApath or smtpd_tls_CAfile to trick outlook.com
    288. 

  288. # See <http://postfix.1071664.n5.nabble.com/Problems-with-incoming-mails-from-outlook-com-td78356.html>
    289. 

  289. _postconf -X smtpd_tls_CApath
    290. 

  290. _postconf -X smtpd_tls_CAfile
    291. 

  291. 

  292. # obsolete TLS-related settings
    293. 

  293. _postconf -X smtpd_use_tls
    294. 

  294. _postconf -X smtp_tls_CApath
    295. 

  295. _postconf -X lmtp_tls_CApath
    296. 

  296. _postconf -X smtp_tls_CAfile
    297. 

  297. _postconf -X lmtp_tls_CAfile
    298. 

  298. _postconf -X smtpd_tls_ask_ccert
    299. 

  299. _postconf -X smtp_tls_note_starttls_offer
    300. 

  300. _postconf -X smtpd_tls_session_cache_database
    301. 

  301. _postconf -X smtpd_tls_session_cache_timeout
    302. 

  302. _postconf -X smtp_tls_session_cache_database
    303. 

  303. _postconf -X tls_random_exchange_name
    304. 

  304. _postconf -X tls_random_source
    305. 

  305. 

  306. # submission
    307. 

  307. # <http://www.postfix.org/SASL_README.html>
    308. 

  308. # <https://doc.dovecot.org/configuration_manual/howto/postfix_and_dovecot_sasl/#using-sasl-with-postfix-submission-port>
    309. 

  309. if [ -n "$submission" ]; then
    310. 

  310.     _postconf -Me submission/inet='
    311. 

  311. submission inet n   -   y   -   -   smtpd
    312. 

  312.     -o syslog_name=postfix/$service_name
    313. 

  313.     -o smtpd_tls_security_level=encrypt
    314. 

  314. '
    315. 

  315.     _postconf -Me smtps/inet='
    316. 

  316. smtps inet  n   -   y   -   -   smtpd
    317. 

  317.     -o syslog_name=postfix/$service_name
    318. 

  318.     -o smtpd_tls_wrappermode=yes
    319. 

  319.     -o smtpd_sasl_auth_enable=yes
    320. 

  320. '
    321. 

  321.     if [ -n "$sasl_inbound" ]; then
    322. 

  322.         _postconf -Me submission/inet/smtpd_sasl_auth_enable=yes
    323. 

  323.         _postconf -Me smtps/inet/smtpd_sasl_auth_enable=yes
    324. 

  324.     else
    325. 

  325.         _postconf -MX submission/inet/smtpd_sasl_auth_enable
    326. 

  326.         _postconf -MX smtps/inet/smtpd_sasl_auth_enable
    327. 

  327.     fi
    328. 

  328. else
    329. 

  329.     _postconf -MX submission/inet
    330. 

  330.     _postconf -MX smtps/inet
    331. 

  331. fi
    332. 

  332. if [ -n "$sasl_inbound" ]; then
    333. 

  333.     _postconf -e smtpd_sasl_local_domain='$mydomain'
    334. 

  334.     _postconf -e smtpd_sasl_type=dovecot
    335. 

  335.     _postconf -e smtpd_sasl_path=private/auth
    336. 

  336.     _postconf -e broken_sasl_auth_clients=yes
    337. 

  337. else
    338. 

  338.     _postconf -X smtpd_sasl_local_domain
    339. 

  339.     _postconf -X smtpd_sasl_type
    340. 

  340.     _postconf -X smtpd_sasl_path
    341. 

  341.     _postconf -X broken_sasl_auth_clients
    342. 

  342. fi
    343. 

  343. 

  344. # obsolete SASL-related settings
    345. 

  345. _postconf -X smtpd_sasl_auth_enable
    346. 

  346. _postconf -X smtpd_sasl_security_options
    347. 

  347. 

  348. if [ -n "$amavis" ]; then
    349. 

  349.     _postconf -e 'max_use = 10' # Avoid too much reuse
    350. 

  350.     amavis_maxproc=$(getperlvarfromfile max_servers "$default_amavis_maxproc" amavisd.conf.addon amavis)
    351. 

  351.     _postconf -Me amavisfeed/unix="
    352. 

  352. amavisfeed unix -   -   n   -   $amavis_maxproc lmtp
    353. 

  353.     -o lmtp_data_done_timeout=1200s
    354. 

  354.     -o lmtp_never_send_ehlo=yes
    355. 

  355.     -o lmtp_send_xforward_command=yes
    356. 

  356.     -o disable_dns_lookups=yes
    357. 

  357.     -o max_use=20
    358. 

  358. "
    359. 

  359.     _postconf -Me 127.0.0.1:10025/inet='
    360. 

  360. 127.0.0.1:10025 inet n  -   n   -   -   smtpd
    361. 

  361.     -o content_filter=
    362. 

  362.     -o local_recipient_maps=
    363. 

  363.     -o relay_recipient_maps=
    364. 

  364.     -o smtpd_restriction_classes=
    365. 

  365.     -o smtpd_delay_reject=no
    366. 

  366.     -o smtpd_client_restrictions=permit_mynetworks,reject
    367. 

  367.     -o smtpd_helo_restrictions=
    368. 

  368.     -o smtpd_sender_restrictions=
    369. 

  369.     -o smtpd_recipient_restrictions=permit_mynetworks,reject
    370. 

  370.     -o smtpd_data_restrictions=reject_unauth_pipelining
    371. 

  371.     -o smtpd_end_of_data_restrictions=
    372. 

  372.     -o mynetworks=127.0.0.0/8
    373. 

  373.     -o smtpd_error_sleep_time=0
    374. 

  374.     -o smtpd_soft_error_limit=1001
    375. 

  375.     -o smtpd_hard_error_limit=1000
    376. 

  376.     -o smtpd_client_connection_count_limit=0
    377. 

  377.     -o smtpd_client_connection_rate_limit=0
    378. 

  378.     -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks,no_milters
    379. 

  379. '
    380. 

  380.     _postconf -e receive_override_options=no_address_mappings
    381. 

  381.     if [ -n "$dkimproxy" ]; then
    382. 

  382.         _postconf -e 'content_filter = amavisfeed:[127.0.0.1]:10028'
    383. 

  383.         _postconf -Pe pickup/fifo/content_filter=dkimsign:127.0.0.1:10028
    384. 

  384.         if [ -n "$submission" ]; then
    385. 

  385.             _postconf -Pe submission/inet/content_filter='dkimsign:[127.0.0.1]:10028'
    386. 

  386.             _postconf -Pe smtps/inet/content_filter='dkimsign:[127.0.0.1]:10028'
    387. 

  387.         fi
    388. 

  388.         _postconf -Me dkimsign/unix="
    389. 

  389. dkimsign unix   -   -   n   -   $dkimproxy_maxproc_out  smtp
    390. 

  390.     -o smtp_send_xforward_command=yes
    391. 

  391.     -o smtp_discard_ehlo_keywords=8bitmime,starttls
    392. 

  392. "
    393. 

  393.         _postconf -Me 127.0.0.1:10029/inet='
    394. 

  394. 127.0.0.1:10029 inet n  -   n   -   -   smtpd
    395. 

  395.     -o content_filter=
    396. 

  396.     -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks,no_milters
    397. 

  397.     -o smtpd_helo_restrictions=
    398. 

  398.     -o smtpd_client_restrictions=
    399. 

  399.     -o smtpd_sender_restrictions=
    400. 

  400.     -o smtpd_recipient_restrictions=permit_mynetworks,reject
    401. 

  401.     -o mynetworks=127.0.0.0/8
    402. 

  402.     -o smtpd_authorized_xforward_hosts=127.0.0.0/8
    403. 

  403. '
    404. 

  404.     else
    405. 

  405.         _postconf -e 'content_filter = amavisfeed:[127.0.0.1]:10024'
    406. 

  406.         _postconf -PX pickup/fifo/content_filter
    407. 

  407.         if [ -n "$submission" ]; then
    408. 

  408.             _postconf -PX submission/inet/content_filter
    409. 

  409.             _postconf -PX smtps/inet/content_filter
    410. 

  410.         fi
    411. 

  411.     fi
    412. 

  412. else
    413. 

  413.     _postconf -X content_filter
    414. 

  414.     _postconf -X receive_override_options
    415. 

  415. fi
    416. 

  416. 

  417. diff -ruN "$confdir" "$tempdir" || if [ $? -gt 1 ]; then exit $?; else needs_reload="1"; fi
    418. 

  418. 

  419. if [ "$force" = "1" ]; then
    420. 

  420.     do_update="y"
    421. 

  421. elif [ "1" = "$needs_reload" ]; then
    422. 

  422.     echo -n "Above is the intended changes. OK to update (y/N)? "
    423. 

  423.     read do_update
    424. 

  424. fi
    425. 

  425. case $do_update in
    426. 

  426.     y|Y)
    427. 

  427.     if [ -f "$tempdir/COMMANDS" ]; then
    428. 

  428.         cat "$tempdir/COMMANDS" | sh -s
    429. 

  429.     fi
    430. 

  430.     rm -f "$tempdir/COMMANDS"
    431. 

  431. 

  432.     diff -q "$confdir/master.cf" "$tempdir/master.cf" || if [ $? -gt 1 ]; then exit $?; else needs_restart="1"; fi
    433. 

  433. 

  434.     cp -a -f -t "$confdir" "$tempdir"/*
    435. 

  435.     rm -rf "$tempdir"
    436. 

  436. 

  437.     for file in $postmapfiles; do
    438. 

  438.         postmap "$confdir/$file"
    439. 

  439.     done
    440. 

  440. 

  441.     if [ "1" = "$needs_restart" ]; then
    442. 

  442.         invoke-rc.d postfix restart
    443. 

  443.     else
    444. 

  444.         invoke-rc.d postfix force-reload
    445. 

  445.     fi
    446. 

  446. 

  447.     if [ "1" = "$needs_reload" ]; then
    448. 

  448.         echo >&2 "Changes applied!"
    449. 

  449.     fi
    450. 

  450.     ;;
    451. 

  451.     *)
    452. 

  452.     if [ "1" = "$needs_reload" ]; then
    453. 

  453.         exit1 "Aborted!"
    454. 

  454.     fi
    455. 

  455.     ;;
    456. 

  456. esac
    457. 

  457. 

  458. if [ "1" != "$needs_reload" ]; then
    459. 

  459.     echo >&2 "No changes needed!"
    460. 

  460. fi
    461. 

  461. 

  462. # Based on this: http://jimsun.linxnet.com/misc/postfix-anti-UCE.txt
    463. 

  463. # Support for trusted MX backup networks added
    464. 

  464. # PCRE stuff avoided, as PCRE is only optional on newest Debian packages
    465. 

  465. # RBLs replaced with those recommended by http://www.antispews.org/
    466. 

  466. # spam filter based on these: http://www.postfix.org/FILTER_README.html
    467. 

  467. #   https://www.ijs.si/software/amavisd/amavisd-new-docs.html
    468. 

  468. # TLS based on this: http://www.postfix.org/TLS_README.html
    469. 

  469. 

  470. # Here's a convenient overview of different blackholes:
    471. 

  471. #   http://rbls.org/
    472.
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-02 15:29:32 +0000